I'm working on a plugin that needs to encrypt some user data. I'm setting an encryption key for SecurityService, but am trying to decide where to store that encryption key so it can be used on subsequent requests to decrypt the data. A few options are coming to mind:

  1. StatePersister: this is where Craft keeps its cookie validation key, but is likely to be ignored by .gitignore, so probably wouldn't be persistent for long.

  2. Plugin Settings Table: this is the approach being used by the SecureField Plugin. It's very straightforward, but also minimally secure as pretty much any SQL injection attack would compromise the key and its encrypted data. The upside is that the key's persistence is practically guaranteed.

  3. Extend CStatePersister: This could be used to persist state in a writable location of my plugin's folder. It's more likely that this would be preserved in version control, but not very likely that the location will be writable on a production server.

As it stands, storing the key in the database is the most likely to work on a wide variety of servers, but probably has the poorest level of security. Am I missing any other options?


I'm hardly a security expert but if someone can get to your filesystem or your db, you'd be screwed either way—so what you're really doing is technically obfuscation and not really encryption. Ideally you'd do the crypto on a different server or have a hardware module that does the encryption and sends the result back but that solution probably won't work here.

Like you mentioned, if you're storing data in the database, don't keep your key in the db. That would be like taping the combination to the outside of a safe. If someone got a dump of the database, they'd be able to use the key to decrypt the data, obviously.

Keep it simple. I'd probably opt for somewhere in the filesystem, like in your plugin's config for example. Leave the key blank until you're ready to use the plugin for production and then have the user fill in the value... maybe with something like WordPress's Secret key generator... that way, nobody has the same key even if someone were to get a copy of your plugin's source code.

  • 1
    +1 for on the file system or as an environment variable.
    – Brad Bell
    Feb 17 '15 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.